EUVD-2026-76937
GHSA-fj9c-wr2v-556h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:L/U:X
Network-reachable unauthenticated DoS; non-default listener is a deployment prerequisite not an attack-time complexity factor; availability-only impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).
AnalysisAI
Denial of service in UnrealIRCd's embedded webserver (versions 6.0.5-6.2.6) allows unauthenticated remote attackers to exhaust server memory by sending an HTTP request containing an unbounded number of headers, rendering the IRC daemon unresponsive. The attack surface exists only when a WebSocket or JSON-RPC listener is explicitly enabled, both of which are disabled in the default configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target UnrealIRCd instance has at least one WebSocket listener or JSON-RPC listener explicitly defined and active in its configuration - both are disabled by default and must be deliberately enabled by the operator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a trivially automatable, network-reachable, unauthenticated availability attack - impact is bounded to the IRC daemon itself with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to UnrealIRCd 6.2.7, confirmed as the patched release by the vendor forum advisory at https://forums.unrealircd.org/viewtopic.php?t=9483. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify your UnrealIRCd version and whether WebSocket or JSON-RPC listeners are enabled in production; if running versions 6.0.5-6.2.6 with either listener active, flag for immediate remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Debian
Bug #1039021| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today